I need some help regarding calls in assembly with Ollydbg. I'm messing around with a simple application. So far, so good, I created a codecave for myself to add some code.
But whenever I try to create a call to a function outside my debugged executable module to, for example, a
msvcrt function, it messes everything up.
Let's look at some random call in the application:
0041D654 FF15 DC714200 CALL DWORD PTR DS:[<&KERNEL32.GetCommandLineA>]
When I double click it, it shows me
CALL DWORD PTR DS:[4271DC]
4271DC seems to point to
76FB496D, which is, indeed:
76FB496D >-FF25 60070177 JMP DWORD PTR DS:[<&api-ms-win-core-processenvironment-l1-2-0.Get> ;KERNELBA.GetCommandLineA
Well, I just stole that from the application itself.
Now I want to create a call to
I assemble a line and enter
CALL DWORD PTR DS:[Kernel32.GetCommandLineA]
Now it's saying:
0041D654 FF15 6D49FB76 CALL DWORD PTR DS:[KERNEL32.GetCommandLineA]
Assemble the line
CALL DWORD PTR DS:[76FB496D]. Giving this a run works fine ofcourse, but whenever I run it like this on another pc, all hell breaks loose.
My question is: How can I make such an pointer
CALL DWORD PTR DS:[4271DC], so the code runs on all pc's?
I can of course use
CALL DWORD PTR DS:[4271DC] in the application to call the function
getcomandlineA whenever I want, but I don't know the (dynamic?) pointer to, let's say,